McMorris Rodgers, House Democrats back compromise to pass historic privacy bill. But will Cantwell let it pass?

WASHINGTON – Congress appears closer than ever to passing sweeping legislation that would set national standards for how tech companies collect and use Americans’ personal data, but that won’t happen unless two Washington lawmakers can get on the same page.

In a near-unanimous, 53-2 vote Wednesday, the House Energy and Commerce Committee approved a revised version of the American Data Privacy and Protection Act, a bipartisan bill championed by Rep. Cathy McMorris Rodgers of Spokane, the top Republican on the panel, and Chairman Frank Pallone, D-N.J.

“This committee has worked for years to achieve a bipartisan federal privacy and data security standard,” McMorris Rodgers said before the vote. “This is the closest that we’ve ever come to establishing a strong, national standard, a standard that the American people have said for a long time is urgently needed.”

The centerpiece of the House bill is “data minimization,” a set of rules that essentially bar companies from collecting and keeping information about users without good reason. That would be a major departure from the current consent-based system that requires users to scroll through long privacy agreements and barrages them with pop-ups asking for their permission to be tracked.

It would apply stricter rules for data on children. While it wouldn’t ban targeted advertising altogether, it would let adults opt out of targeted ads and prohibit the practice for people under 17. It would also prohibit using data to discriminate based on race, sex, religion and other protected characteristics.

Wednesday’s vote marked the first time a comprehensive consumer privacy bill has made it out of committee in the two decades Congress has spent trying to update regulations for the 21st century. Both parties have made concessions to ensure it can pass the House with bipartisan support, but that won’t matter without the backing of Sen. Maria Cantwell, the Washington Democrat who chairs the Senate Commerce Committee.

In an interview Wednesday, while the House panel was still revising its bill, Cantwell said she couldn’t support the bipartisan framework unless House lawmakers add tougher enforcement measures, including limits on forced arbitration and a broad right for individuals to sue companies that violate the law.

“The problem is it’s taking the House a long time to come to reality about what strong enforcement looks like,” Cantwell said. “If you’re charitable, you call it ignorance. If you think that it’s purposeful, it literally won’t pass the House because they just won’t meet the test of what a strong federal bill looks like.”

The House committee made some changes in response to Cantwell’s objections, but it remains to be seen whether they go far enough to win her support. In the interview, Cantwell took aim at compromises in the House bill that have been key to securing bipartisan agreement.

It would let individuals sue companies directly for violating the law, as Democrats have insisted, but only after notifying the Federal Trade Commission and their state attorney general’s office, a provision Republicans sought. The original House bill also delayed that “private right of action” for four years to give companies and regulators time to adapt, a period that was halved to two years during Wednesday’s markup.

Caitriona Fitzgerald, deputy director of the Electronic Privacy Information Center, a nonprofit research and advocacy group, said while she understands Cantwell’s objection to delaying that right to sue, even a four-year delay would be better than the status quo.

“While the private right of action could be stronger,” she said, “right now we have none.”

The House legislation would also override state privacy laws, as Republicans have insisted, to avoid a patchwork of different laws across the country, with an exception sought by Democrats for a pioneering California law.

Rep. Anna Eshoo, one of two California Democrats who voted against the bill Wednesday, said a carveout in the bill that would let her state’s privacy regulator enforce the California law doesn’t go far enough.

“I recognize that this law would be an improvement for much of the country,” she said, “but I can’t say the same for my constituents and all Californians.”

India McKinney, director of federal affairs at the Electronic Frontier Foundation, an online civil liberties group, said pre-empting state laws too broadly could hamper the nation’s ability to keep up with the rapidly changing tech industry.

“States can just move faster than the federal government,” she said. “And so using the states as ‘laboratories of democracy’ is a really useful thing to do in a new area of law and technology, as a way to help the federal government get it right. If the federal government passes something that doesn’t allow the states to continue doing the work, they’re really hamstringing their future efforts, as well as the privacy rights of their constituents.”

Shane Tews, a nonresident senior fellow at the American Enterprise Institute, a conservative think tank, said letting states enact a patchwork of different privacy laws – as they have done in the absence of a federal law – means companies need to adapt their products to each state and track a user’s location to know which rules apply.

“That’s tricky, it’s expensive and it’s a barrier to entry to smaller companies,” she said, “which is why you’re seeing both large and small companies have an interest in there being a national privacy law around data collection.”

Jon Leibowitz, who chaired the Federal Trade Commission from 2009 -13, said nearly all stakeholders involved in crafting legislation understand that a federal law would have to override some state laws, with some exceptions. He added that both the House bill and Cantwell’s legislation are stronger than any state law, including California’s, and the consumer privacy bill that has twice passed the Washington State Senate before getting stuck in the state House.

“Everybody knows you have to have some pre-emption,” he said. “They’re arguing over where to put the guardrails, but not arguing over having it.”

In a June 24 letter to the lead House and Senate negotiators – Cantwell, McMorris Rodgers, Pallone and Sen. Roger Wicker, R-Miss. – Washington Attorney General Bob Ferguson threw his support behind a separate bill Cantwell has championed and echoed her criticisms of the bipartisan legislation.

The House bill would require Washingtonians to notify his office and wait 60 days before suing a company, but Ferguson said the FTC and state attorneys general represent groups of people hurt by a violation of the law, not individuals, and argued a 60-day wait “will only delay the ability of individuals to seek relief.”

Ferguson criticized the House bill’s lack of whistleblower protections, which Cantwell’s legislation includes, and pointed out a loophole he said could let companies keep data to “conduct internal research or analytics.” He also warned against pre-empting state laws without a strong federal law, telling the lawmakers, “Americans cannot afford for you to get this wrong.”

The House bill represents a rare bipartisan accomplishment in an election year, a political environment where Democrats and Republicans often spurn compromise, but the Supreme Court made the negotiations more complicated with its decision to overturn federal abortion protections on June 24. On Wednesday, Cantwell signaled the ruling may change her willingness to compromise on privacy legislation.

“The challenges that we see in an information age are just going to keep coming at us, and the abuses of this data,” she said. “When this started, no one thought about the Supreme Court decision.”

Some abortion-rights advocates say state laws that criminalize abortion necessitate specific provisions in a federal bill to keep law enforcement agencies from using data to prosecute someone for seeking an abortion.

“This bill, at least from the perspective of pregnant people, it really doesn’t do much,” Kim Clark, a senior attorney at the Seattle-based nonprofit Legal Voice, said of the House legislation.

Shaunna Thomas, executive director of UltraViolet, a nonprofit advocacy group focused on gender justice, called the House bill “a good start” but said it should be improved “to meet the needs that have become far more acute in a post-Roe society.”

“We see an opportunity for asking Democrats to recognize the threats that have become far more acute in a post-Roe world,” she said, “and to consider using the leverage they have – which is not insignificant – to consider these improvements in that light.”

Yet Republicans are likely to block any legislation that explicitly aims to protect access to abortion, and Fitzgerald said the bipartisan bill already includes protections that are urgently needed in the wake of the high court’s ruling in Dobbs v. Jackson Women’s Health Organization.

“I think the Dobbs decision made the risks of all of this data collection real for a lot of people, but that’s why it’s so important to have a federal privacy law that limits the collection,” she said. “Because if companies can’t collect this data in the first place, it can’t be given to law enforcement in states that are criminalizing abortion.”

Privacy advocates and members of the House committee, including Democrats, have expressed frustration with Cantwell’s opposition to their bill. After the legislation advanced through a subcommittee June 23, Rep. Jan Schakowsky, D-Ill., told reporters she hoped the Washington senator wouldn’t “get in the way.”

“After years of work in this committee, and across the Congress and with all the stakeholders, we have finally come up with a landmark compromise,” Schakowsky said during Wednesday’s markup. “Probably almost everyone could find something that they wish were different in the bill. On the other hand, I do think that we do have a mandate from the American people who are just fed up now with the lack of privacy online.”

Cameron Kerry, a visiting fellow at the Brookings Institution who worked on data privacy as the Commerce Department’s top lawyer during the Obama administration, said a turning point in the decadeslong privacy talks in Congress came when McMorris Rodgers and other Republicans on her committee outlined a proposal in 2021 that civil society groups saw as a viable starting point for bipartisan legislation.

“I think the bipartisanship comes for a variety of reasons,” said Kerry, whose brother is former Secretary of State John Kerry. “First and foremost, members of Congress are consumers, they are parents, they go online, and I think they’re concerned about what’s happening to their information and their families’ information.”

Proponents of the House bill say it represents an opportunity for Congress to enact a law that is overwhelmingly popular, pointing to a Politico/Morning Consult poll conducted June 10-12 that found more than 80% of Americans support several of the bill’s provisions.

In May, a coalition of civil rights and consumer protection groups called on Congress to pass a comprehensive, bipartisan privacy bill.

One of those organizations is the Lawyers’ Committee for Civil Rights Under Law. David Brody, managing attorney of the group’s Digital Justice Initiative, said the United States lags behind the European Union and other countries, which have enacted some baseline protections to limit how companies collect and use personal data.

“As long as a company gives you a 100-page privacy policy that, somewhere in the fine print, says they’re going to do X, Y, Z with your data, then they can do whatever they want with it,” he said. “The world we live in now puts all of the burden on the consumer to protect themselves online. It’s like the Wild West, and that’s not that way we regulate commerce in any other area of life.”

Instead, Brody said, tech companies should be regulated more like automakers who don’t require customers to understand how each part of an engine works or to opt into having airbags in a car.

Leibowitz said groups that have historically pushed for the tougher enforcement measures Cantwell wants – including civil rights advocates and trial lawyers – have backed the House effort partly because they expect to be in a weaker negotiating position next year, when Sen. Ted Cruz of Texas is expected to replace Wicker as the top Republican on the Commerce Committee.

When asked if she feels urgency to pass a bill this year, Cantwell said her message to fellow lawmakers is, “Don’t take the bait on a weak bill.”

“Ever since I’ve been on the Commerce Committee, the big data companies have been pushing to get a weak federal bill to override strong state law,” she said. “Even those civil rights groups have been infiltrated by people who are trying to push them to support a weak bill.”

Fitzgerald said Democrats should seize the opportunity to pass privacy legislation this year, since the need is so urgent and conditions in Congress are likely to be less favorable for the party next year. Republicans are heavily favored by oddsmakers to win control of the House in November’s election, an outcome that would make McMorris Rodgers chair of the Energy and Commerce Committee, while the Senate is considered a toss-up.

“The time has come,” Fitzgerald said. “We’re in a crisis, so we need to do something, and with all due respect to Sen. Cantwell, she’s the chair of the relevant committee, so if she thinks the bill should be stronger, she should bring it for a markup and amend it to be stronger. But by not moving it forward at all, that doesn’t help consumers.”

Asked on Wednesday when she planned to hold a markup of a Senate privacy bill, Cantwell said only that she was “considering what our next moves are” and would “look at our schedule.”

Some digital rights advocates have gone further, accusing Cantwell of not working in good faith to pass legislation. Evan Greer, director of the nonprofit advocacy group Fight for the Future, wrote June 23 on Twitter that Cantwell’s goal “is not to push for a better bill but rather to blow up any deal.”

But Leibowitz, the former FTC chairman, said he believes “everyone is sincere,” including Cantwell, about negotiating complex legislation that would impact all Americans.

“Chairwoman Cantwell, if privacy legislation is enacted this year, she could be the next Warren Magnuson or the next John Sherman,” he said, referring to a prominent Washington senator who served from 1944 to 1981 and the architect of a foundational 1890 anti-monopoly law. “Because privacy legislation today is as important as antitrust legislation was a century ago.”

The House, where bills can be passed with a simple majority, is typically the realm of partisan legislation while compromises are made in the Senate. Yet individual senators effectively wield veto power over bills that have to pass through the committees they lead. Time will tell how those dynamics play out.

“The stakes here are enormous,” Leibowitz said. “If it happens, it’ll be a rare instance where Congress will be acting in an important, bipartisan way for the people they represent, with real, tangible effects to consumers in a positive way.”